services

Services of a Windows, by WinRM

Returns the state and the start mode of each service of a Windows, stopped services included. Three watches are proposed, each one set on the probe; the first, checked, raises on any service set to start automatically that does not run.

Versions

Windows Server 2012 and later, Windows 8 and later: Windows PowerShell 3.0, which the collector needs, ships with each of them; the WinRM service runs by default on every Windows Server from 2012 on, and winrm quickconfig starts it on a desktop Windows. Generic: no folder of version. That every release answers alike is assumed, not yet checked on a real Windows.

How it works

The collector runs one PowerShell script, by WinRM, that reads Win32_Service, one object per service, and in the registry the services whose automatic start is delayed:

[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding; ConvertTo-Json -Compress -Depth 4 -InputObject @{services = @(Get-CimInstance Win32_Service | Select-Object Name, State, StartMode); delayed = @(Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Services | Get-ItemProperty -Name DelayedAutostart -ErrorAction SilentlyContinue | Where-Object DelayedAutostart -eq 1 | Select-Object PSChildName)}

• WinRM hands the script to PowerShell itself: no shell stands in between, and the script is the one of windows/ssh/services, without the powershell -Command "…" that cmd.exe needs there. The default shell of an OpenSSH server does not matter here.
• The delayed start is read in the registry, the value DelayedAutostart at 1 under the key of the service: Win32_Service does not serve it on every Windows from Server 2012 on. A key the account may not read is skipped: its service, if automatic, is then judged as an automatic one without delay.
• A service is named by its service name (wuauserv, Spooler, MSSQLSERVER), the same in every language of Windows; never by its display name, which is translated.
• The state and the start mode are written by WMI in English whatever the language of the system. They are returned in lower case, words joined by -: - state: running, stopped, start-pending, stop-pending, paused, pause-pending, continue-pending; - start mode: auto, delayed (automatic, delayed start), manual, disabled, boot, system.
• "Automatic service stopped" raises, critical, on each service whose start mode is auto and whose state is not running. A service in delayed automatic start is left to it: Windows may stop it once its work is done.
• The default selection is every service but RemoteRegistry, which Windows Server sets to start automatically on a trigger and stops when it is idle. Leave out on the probe any other service that starts and stops on its own.
• Nothing is skipped at the first run.
• No service at all, or an answer that is not the expected JSON, stops the collector as misconfigured.

Nothing is written to the Windows: the script only reads.

Prerequisites

• The WinRM service of Windows listening in HTTPS. The service runs by default on every Windows Server from 2012 on (on a desktop Windows, winrm quickconfig starts it), with an HTTP listener only; the HTTPS listener needs a certificate: - a certificate for server authentication in the store of the computer (Cert:\LocalMachine\My), bearing the name the poller connects to: issued by the authority of the company, or made on the server by New-SelfSignedCertificate -DnsName <name> -CertStoreLocation Cert:\LocalMachine\My from Windows Server 2012 R2 on (Windows Server 2012 does not have this command); - then the listener: winrm quickconfig -transport:https finds a certificate of an authority by itself, but refuses a self-signed one; the command that takes either, on every Windows from Server 2012 on, is winrm create winrm/config/Listener?Address=*+Transport=HTTPS @{Hostname="<name>";CertificateThumbprint="<thumbprint>"} in cmd.exe, the thumbprint being the one Windows shows for the certificate.
• The Windows firewall open to the poller on TCP 5986, which creating the listener does not do: New-NetFirewallRule -DisplayName "WinRM HTTPS" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow in PowerShell. A listener on another port is set in protocol:winrm:port.
• The certificate judged by the poller before the account is sent, by the TLS profile of the probe: issued by an authority the system of the poller knows, by an authority added in protocol:tls:authorities, or pinned in protocol:winrm:fingerprint, the way for a self-signed certificate; the pin is not needed when the Security settings trust the first WinRM fingerprint presented. The fingerprint is sha256: followed by the SHA-256 of the certificate in 64 lower-case hexadecimal characters; from a machine that reaches the port, openssl s_client -connect <name>:5986 </dev/null | openssl x509 -noout -fingerprint -sha256 prints it, in capitals, with colons to take off. A certificate whose name is not the address of the host is judged on the name set in protocol:tls:server-name.
• NTLM authentication, which the WinRM service accepts as installed (Negotiate = true in winrm get winrm/config/service/auth): the password never travels, only an answer computed with it. A domain that refuses NTLM is not served.
• Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
• An account for monitoring, without administrator rights, local or of the domain, set in protocol:winrm:user (account, DOMAIN\account or account@domain) with its password in protocol:winrm:password, member of the local group "Remote Management Users", which opens WinRM to an account that is not an administrator. No other group: Win32_Service and the keys of the services in the registry are open to any account.

Outputs

Watches

"Service stopped" is for a selection of services that must run whatever their start mode: check it once the selection is set to "Only" those services. "Service missing" looks at every service returned, inside the selection or not: a service named there that is uninstalled raises.

Limits

• A certificate of the listener that expires, or a pinned one that is renewed, stops every WinRM collector of the host: the network/tls/certificate collector of banshee/web-collection, deployed on port 5986, watches it.
• A service set to start automatically on a trigger (a device, a network event) may stop on its own: it then raises "Automatic service stopped" until it is left out of the selection.
• A Windows has a few hundred services: the default selection returns every one but RemoteRegistry.
• Not yet checked on a real Windows: that RemoteRegistry starts on a trigger on every Windows Server; that setting the output encoding is accepted where WinRM runs PowerShell without a console (a refusal is an error beside the answer, which still arrives).